@bigstrider/transcodes-cli 0.7.0 → 0.9.0

package/dist/index.js

@@ -3,7 +3,7 @@
 // ../packages/core/dist/stepup/client.js
 var REQUEST_TIMEOUT_MS = 3e4;
 async function request(config, input) {
-  const path2 = input.path.startsWith("/") ? input.path : `/${input.path}`;
+  const path3 = input.path.startsWith("/") ? input.path : `/${input.path}`;
   const params = new URLSearchParams();
   if (input.query) {
     for (const [k, v] of Object.entries(input.query)) {
@@ -13,14 +13,11 @@ async function request(config, input) {
     }
   }
   const qs = params.toString();
-  const url = `${config.apiBaseV1}${path2}${qs ? `?${qs}` : ""}`;
+  const url = `${config.apiBaseV1}${path3}${qs ? `?${qs}` : ""}`;
   const headers = {
     "x-transcodes-token": config.token,
     Accept: "application/json"
   };
-  if (input.stepUpSid) {
-    headers["X-Step-Up-Session-Id"] = input.stepUpSid;
-  }
   let body;
   const sendsBody = input.method !== "GET" && !input.omitBody;
   if (sendsBody) {
@@ -495,6 +492,14 @@ async function openConsoleSession(options) {
 
 // src/commands.ts
 var CLI_COMMAND_SPECS = [
+  {
+    usage: "transcodes install",
+    description: "Guided setup: pick host plugins to install, save a token, then open the dashboard (--all / <platforms>)"
+  },
+  {
+    usage: "transcodes update",
+    description: "Update installed host plugins in place and bump this CLI from npm (--cli-only / --plugins-only / --all)"
+  },
   {
     usage: "transcodes",
     description: "Open the local dashboard (URL printed in terminal; default port 3847; --port N / --no-open)"
@@ -557,11 +562,12 @@ function renderCliCommandsHtml() {
 }
 
 // src/dashboard.ts
-import { spawn as spawn2 } from "child_process";
+import { execFile, spawn as spawn2 } from "child_process";
 import { createHash } from "crypto";
 import {
   createServer
 } from "http";
+import { promisify } from "util";
 
 // ../packages/core/dist/contract/messages.js
 var TRANSCODES_GUARD_REPO_URL = "https://github.com/transcodings/transcodes-guard";
@@ -619,7 +625,10 @@ var CLI_VERSION = pkg.version;
 // src/dashboard.ts
 var DEFAULT_PORT = 3847;
 var HOST = "127.0.0.1";
-var GUIDELINE_MUX_PLAYBACK_ID = "01Q02da00mR6xobESjn2KHOz31eGX3OUS01xoc025RKQxsR4";
+var PORT_ATTEMPTS = 10;
+var GUIDELINE_MUX_PLAYBACK_ID = "h1vOCPmFDA02fGhcout01FZWD4lpKNTzLFk7vybxvrc3M";
+var APP_ORG_URL = "https://app.transcodes.io/en/org";
+var execFileAsync = promisify(execFile);
 function fingerprint(token) {
   return createHash("sha256").update(token).digest("hex").slice(0, 12);
 }
@@ -827,6 +836,24 @@ function dashboardHtml() {
       font-weight: 600;
       line-height: 1.45;
     }
+    .header-token-empty-title { margin: 0; }
+    .header-token-empty-cmds {
+      margin: 10px 0 0;
+      display: flex;
+      flex-direction: column;
+      align-items: flex-start;
+      gap: 6px;
+    }
+    .header-token-empty-cmds code {
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: var(--text-2xs);
+      font-weight: 600;
+      color: var(--accent);
+      background: #fff;
+      border: 1px solid #f5c6cb;
+      padding: 3px 9px;
+      border-radius: 7px;
+    }
     .header-profile {
       display: flex;
       align-items: center;
@@ -862,6 +889,9 @@ function dashboardHtml() {
     }
     .btn-manage-auth {
       flex-shrink: 0;
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
       border: none;
       border-radius: 10px;
       padding: 10px 16px;
@@ -872,6 +902,11 @@ function dashboardHtml() {
       cursor: pointer;
       transition: opacity 0.15s ease, transform 0.15s ease;
     }
+    .btn-manage-auth svg {
+      width: 20px;
+      height: 20px;
+      flex-shrink: 0;
+    }
     .btn-manage-auth:hover:not(:disabled) { opacity: 0.92; }
     .btn-manage-auth:disabled {
       opacity: 0.55;
@@ -958,6 +993,12 @@ function dashboardHtml() {
       color: var(--muted);
       margin: 0 0 16px;
     }
+    .section-sub a {
+      color: var(--accent);
+      font-weight: 600;
+      text-decoration: none;
+    }
+    .section-sub a:hover { text-decoration: underline; }
     .cli-map-row {
       display: flex;
       align-items: center;
@@ -1217,8 +1258,8 @@ function dashboardHtml() {
     .list-label {
       margin: 26px 0 10px;
       font-size: var(--text-sm);
-      font-weight: 600;
-      color: var(--muted);
+      font-weight: 700;
+      color: var(--ink);
       letter-spacing: 0.01em;
     }
     .token-list { display: flex; flex-direction: column; gap: 10px; }
@@ -1518,8 +1559,34 @@ function dashboardHtml() {
       line-height: 1.5;
       margin: 0;
     }
-    .guide-video {
+    .guide-video-wrap {
       margin: 0 0 22px;
+    }
+    .guide-video-toggle {
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
+      border: 1px solid var(--line);
+      border-radius: 999px;
+      padding: 6px 12px;
+      font-size: var(--text-xs);
+      font-weight: 600;
+      color: var(--ink);
+      background: #fff;
+      cursor: pointer;
+      transition: background 0.15s ease, border-color 0.15s ease;
+    }
+    .guide-video-toggle:hover {
+      background: #f7f7f9;
+      border-color: #d8d8de;
+    }
+    .guide-video-toggle[aria-expanded="true"] {
+      color: var(--accent);
+      border-color: rgba(91, 84, 230, 0.35);
+      background: var(--accent-soft);
+    }
+    .guide-video {
+      margin: 10px 0 0;
       border-radius: 14px;
       overflow: hidden;
       border: 1px solid var(--line);
@@ -1527,6 +1594,7 @@ function dashboardHtml() {
       aspect-ratio: 16 / 9;
       box-shadow: 0 8px 28px rgba(22, 22, 26, 0.08);
     }
+    .guide-video[hidden] { display: none !important; }
     .guide-video mux-player {
       width: 100%;
       height: 100%;
@@ -1592,6 +1660,37 @@ function dashboardHtml() {
       border: 1px solid var(--line);
       border-radius: 14px;
     }
+    .guide-step--accordion {
+      display: block;
+      padding: 0;
+      overflow: hidden;
+    }
+    .guide-step-summary {
+      display: flex;
+      align-items: center;
+      gap: 14px;
+      padding: 14px 16px;
+      cursor: pointer;
+      list-style: none;
+      user-select: none;
+    }
+    .guide-step-summary::-webkit-details-marker { display: none; }
+    .guide-step-summary::marker { content: ''; }
+    .guide-step-summary:hover { background: #f7f7f9; }
+    .guide-step--accordion[open] .guide-step-summary {
+      border-bottom: 1px solid var(--line);
+    }
+    .guide-step-chevron {
+      margin-left: auto;
+      flex-shrink: 0;
+      width: 16px;
+      height: 16px;
+      color: var(--muted);
+      transition: transform 0.15s ease;
+    }
+    .guide-step--accordion[open] .guide-step-chevron {
+      transform: rotate(180deg);
+    }
     .guide-step-num {
       flex: 0 0 28px;
       width: 28px;
@@ -1606,18 +1705,35 @@ function dashboardHtml() {
       justify-content: center;
     }
     .guide-step-body { min-width: 0; }
+    .guide-step--accordion > .guide-step-body {
+      padding: 12px 16px 14px 58px;
+    }
     .guide-step-title {
       font-size: var(--text-sm);
       font-weight: 700;
       color: var(--ink);
       margin: 0 0 4px;
     }
+    .guide-step-summary .guide-step-title { margin: 0; flex: 1; min-width: 0; }
     .guide-step-desc {
       font-size: var(--text-sm);
       color: var(--muted);
       line-height: 1.5;
       margin: 0;
     }
+    .guide-step-desc a,
+    .guide-console-link {
+      color: var(--accent);
+      font-weight: 600;
+      text-decoration: underline;
+      background: none;
+      border: none;
+      padding: 0;
+      font: inherit;
+      cursor: pointer;
+    }
+    .guide-step-desc a:hover,
+    .guide-console-link:hover { opacity: 0.88; }
     .guide-step-desc code {
       font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
       font-size: var(--text-2xs);
@@ -1711,12 +1827,56 @@ function dashboardHtml() {
       font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
       font-size: var(--text-xs);
     }
+    .guide-prefix-note {
+      margin: 0 0 14px;
+      font-size: var(--text-sm);
+      color: var(--muted);
+      line-height: 1.6;
+    }
+    .guide-prefix-note code.cli-cmd { white-space: nowrap; }
     .guide-help-examples {
       margin: 10px 0 0;
       display: flex;
       flex-direction: column;
       gap: 8px;
     }
+    .guide-cmd-row {
+      display: flex;
+      flex-direction: column;
+      gap: 4px;
+    }
+    .guide-cmd-hosts {
+      font-size: var(--text-2xs);
+      font-weight: 600;
+      color: var(--muted);
+      text-transform: uppercase;
+      letter-spacing: 0.04em;
+    }
+    .guide-classify-list {
+      margin: 10px 0 0;
+      padding: 0;
+      list-style: none;
+      display: flex;
+      flex-direction: column;
+      gap: 8px;
+    }
+    .guide-classify-list li {
+      display: flex;
+      align-items: center;
+      flex-wrap: wrap;
+      gap: 8px;
+      font-size: var(--text-sm);
+      color: var(--muted);
+      line-height: 1.5;
+    }
+    .guide-classify-prompt { color: var(--ink); }
+    .guide-classify-arrow { color: var(--muted); }
+    .guide-classify-note {
+      margin: 10px 0 0;
+      font-size: var(--text-sm);
+      color: var(--muted);
+      line-height: 1.55;
+    }
     .guide-help-examples code.cli-cmd {
       display: block;
       width: fit-content;
@@ -1776,12 +1936,27 @@ function dashboardHtml() {
       display: flex;
       align-items: center;
       justify-content: center;
+      flex-wrap: wrap;
       gap: 8px;
       font-size: var(--text-2xs);
       color: var(--muted);
       text-align: center;
       line-height: 1.6;
     }
+    .dashboard-footer a {
+      display: inline-flex;
+      align-items: center;
+      gap: 5px;
+      color: var(--accent);
+      font-weight: 600;
+      text-decoration: none;
+    }
+    .dashboard-footer a:hover { text-decoration: underline; }
+    .dashboard-footer-github-icon {
+      width: 14px;
+      height: 14px;
+      flex-shrink: 0;
+    }
   </style>
   <script type="module" src="https://cdn.jsdelivr.net/npm/@mux/mux-player"></script>
 </head>
@@ -1803,14 +1978,26 @@ function dashboardHtml() {
           <p class="header-tagline">Manage credentials and view RBAC from one panel \u2014 no CLI typing required</p>
         </div>
       </div>
-      <p id="header-token-empty" class="header-token-empty" hidden>Please register a token first</p>
+      <div id="header-token-empty" class="header-token-empty" hidden>
+        <p class="header-token-empty-title">Invalid Token Configuration. Please register a Transcodes Member Access Token</p>
+        <p class="header-token-empty-title">To get started, run the following commands:</p>
+        <div class="header-token-empty-cmds">
+          <code>npm install -g @bigstrider/transcodes-cli</code>
+          <code>transcodes install</code>
+        </div>
+      </div>
       <div class="header-profile" id="header-profile" hidden>
         <div class="header-profile-info">
           <div class="header-profile-name" id="header-profile-name"></div>
           <div class="header-profile-meta" id="header-profile-meta"></div>
         </div>
         <div class="header-profile-actions">
-          <button type="button" class="btn-manage-auth" id="manage-auth-btn">Manage Auth</button>
+          <button type="button" class="btn-manage-auth" id="manage-auth-btn" data-console-open aria-label="Open Transcodes console">
+            <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
+              <path stroke-linecap="round" stroke-linejoin="round" d="M7.864 4.243A7.5 7.5 0 0 1 19.5 10.5c0 2.92-.556 5.709-1.568 8.268M5.742 6.364A7.465 7.465 0 0 0 4.5 10.5a7.464 7.464 0 0 1-1.15 3.993m1.989 3.559A11.209 11.209 0 0 0 8.25 10.5a3.75 3.75 0 1 1 7.5 0c0 .527-.021 1.049-.064 1.565M12 10.5a14.94 14.94 0 0 1-3.6 9.75m6.633-4.596a18.666 18.666 0 0 1-2.485 5.33" />
+            </svg>
+            Console
+          </button>
           <p class="header-profile-cli-hint"><code>transcodes console</code></p>
         </div>
       </div>
@@ -1824,108 +2011,147 @@ function dashboardHtml() {
 
     <div class="panel active" id="panel-guideline">
       <p class="section-title">Getting Started</p>
-      <p class="section-sub">New to Transcodes? Watch the walkthrough, then follow the steps below</p>
-      <div class="guide-help">
-        <p class="guide-help-line"><strong>For LLM agents</strong> \u2014 prefix prompts with <code class="cli-cmd">/transcodes</code> or <code class="cli-cmd">$transcodes</code> to reduce hallucinations</p>
-        <div class="guide-help-examples">
-          <code class="cli-cmd">/transcodes add signin / stepup / console in our admin dashboard</code>
-          <code class="cli-cmd">/transcodes summarize member audit logs for the past 2 weeks</code>
+      <p class="section-sub">Transcodes CLI Dashboard,Set it up visually \u2014 no terminal required. New to Transcodes? Watch the video.</p>
+      <div class="guide-video-wrap">
+        <button type="button" class="guide-video-toggle" id="guide-video-toggle" aria-expanded="false" aria-controls="guide-video">
+          Watch Intro Video
+        </button>
+        <div class="guide-video" id="guide-video" hidden>
+          <mux-player
+            playback-id="${GUIDELINE_MUX_PLAYBACK_ID}"
+            stream-type="on-demand"
+            accent-color="#5b54e6"
+            primary-color="#ffffff"
+            metadata-video-title="Transcodes CLI onboarding"
+          ></mux-player>
         </div>
       </div>
-      <div class="guide-video">
-        <mux-player
-          playback-id="${GUIDELINE_MUX_PLAYBACK_ID}"
-          stream-type="on-demand"
-          accent-color="#5b54e6"
-          primary-color="#ffffff"
-          metadata-video-title="Transcodes CLI onboarding"
-        ></mux-player>
-      </div>
-      <p class="list-label">Quick setup</p>
+      <p class="list-label">Quick Demo</p>
+      <p class="guide-prefix-note">Try the quick demo to see how Transcodes works</p>
+      <p class="guide-prefix-note">Prefix prompts with <code class="cli-cmd">/transcodes</code> on Claude, Cursor, and Antigravity \u2014 use <code class="cli-cmd">$transcodes</code> on ChatGPT (Codex).</p>
       <div class="guide-groups">
-        <section class="guide-group guide-group--console">
-          <a class="guide-group-label" href="https://app.transcodes.io/" target="_blank" rel="noopener noreferrer">Transcodes Console<span class="guide-group-link-icon" aria-hidden="true"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/></svg></span></a>
+        <section class="guide-group guide-group--panel">
           <ol class="guide-steps">
             <li class="guide-step">
               <span class="guide-step-num">1</span>
               <div class="guide-step-body">
-                <p class="guide-step-title">Create a project</p>
-                <p class="guide-step-desc">Create a new project for your app</p>
+                <p class="guide-step-title">Open your CLI or desktop app (Claude, Cursor, Antigravity, ChatGPT)</p>
+                <p class="guide-step-desc">If it's already running, restart it so the latest plugin and token are loaded</p>
               </div>
             </li>
             <li class="guide-step">
               <span class="guide-step-num">2</span>
               <div class="guide-step-body">
-                <p class="guide-step-title">Create an authentication cluster</p>
-                <p class="guide-step-desc">Add an authentication cluster to define how members sign in and authenticate</p>
-              </div>
-            </li>
-            <li class="guide-step">
-              <span class="guide-step-num">3</span>
-              <div class="guide-step-body">
-                <p class="guide-step-title">Add a member</p>
-                <p class="guide-step-desc">Invite or add a member so they can be issued an access token</p>
-              </div>
-            </li>
-            <li class="guide-step">
-              <span class="guide-step-num">4</span>
-              <div class="guide-step-body">
-                <p class="guide-step-title">Issue an access token</p>
-                <p class="guide-step-desc">Open the member detail page and issue a Member Access Token (MAT) for the agent</p>
-              </div>
-            </li>
-            <li class="guide-step">
-              <span class="guide-step-num">5</span>
-              <div class="guide-step-body">
-                <p class="guide-step-title">Configure RBAC</p>
-                <p class="guide-step-desc">In Role Management, add resources (key, name, description), create roles, and set the permission matrix \u2014 0 deny \xB7 1 allow \xB7 2 step-up MFA</p>
+                <p class="guide-step-title">Trigger a step-up test</p>
+                <p class="guide-step-desc">Ask the agent to run a protected action \u2014 it should prompt for step-up authentication</p>
+                <div class="guide-help-examples">
+                  <div class="guide-cmd-row">
+                    <span class="guide-cmd-hosts">Claude \xB7 Cursor \xB7 Antigravity</span>
+                    <code class="cli-cmd">/transcodes open step-up authentication for testing</code>
+                  </div>
+                  <div class="guide-cmd-row">
+                    <span class="guide-cmd-hosts">ChatGPT (Codex)</span>
+                    <code class="cli-cmd">$transcodes open step-up authentication for testing</code>
+                  </div>
+                </div>
               </div>
             </li>
           </ol>
         </section>
+      </div>
 
+      <p class="list-label">Steps</p>
+      <div class="guide-groups">
         <section class="guide-group guide-group--panel">
-          <p class="guide-group-label">This CLI panel</p>
           <ol class="guide-steps">
-            <li class="guide-step">
-              <span class="guide-step-num">6</span>
-              <div class="guide-step-body">
-                <p class="guide-step-title">Save the token</p>
-                <p class="guide-step-desc">Paste the token in the Tokens tab with a label (e.g. <code>transcodes-myapp-dev</code>) \u2014 the plugin reads it from <code>{{HOME_DIR}}/.transcodes/config.json</code></p>
-              </div>
+            <li>
+              <details class="guide-step guide-step--accordion">
+                <summary class="guide-step-summary">
+                  <span class="guide-step-num">1</span>
+                  <span class="guide-step-title">Configure RBAC in the Transcodes app</span>
+                  <svg class="guide-step-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>
+                </summary>
+                <div class="guide-step-body">
+                  <p class="guide-step-desc">Set up resources, actions, and roles in the <a href="${APP_ORG_URL}" data-app-tab="rbac" target="_blank" rel="noopener noreferrer">Transcodes app</a>. You can review the resulting RBAC permissions read-only in this CLI panel's RBAC tab</p>
+                </div>
+              </details>
             </li>
-            <li class="guide-step">
-              <span class="guide-step-num">7</span>
-              <div class="guide-step-body">
-                <p class="guide-step-title">View RBAC (read-only)</p>
-                <p class="guide-step-desc">Open the RBAC tab to inspect resources and role permission matrices. Create, update, and delete stay in the Transcodes app \u2014 click the logo or Transcodes at the top</p>
-              </div>
+            <li>
+              <details class="guide-step guide-step--accordion">
+                <summary class="guide-step-summary">
+                  <span class="guide-step-num">2</span>
+                  <span class="guide-step-title">Register a passkey or biometrics</span>
+                  <svg class="guide-step-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>
+                </summary>
+                <div class="guide-step-body">
+                  <p class="guide-step-desc">Click the <button type="button" class="guide-console-link" data-console-open>Console</button> button (or run <code class="cli-cmd">transcodes console</code> in your terminal), sign in, then register a passkey or biometrics \u2014 these are used for step-up authentication</p>
+                </div>
+              </details>
             </li>
-          </ol>
-        </section>
-
-        <section class="guide-group guide-group--agent">
-          <a class="guide-group-label" href="${TRANSCODES_GUARD_REPO_URL}" target="_blank" rel="noopener noreferrer">LLM Agent or Admin Back Office<span class="guide-group-link-icon" aria-hidden="true"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/></svg></span></a>
-          <ol class="guide-steps">
-            <li class="guide-step">
-              <span class="guide-step-num">8</span>
-              <div class="guide-step-body">
-                <p class="guide-step-title">Add the transcodes-guard plugin</p>
-                <p class="guide-step-desc">Install the transcodes-guard plugin on Claude, Codex, Cursor (beta), and Antigravity (beta). For more plugins info, visit the repository</p>
-                <p class="guide-step-opensource">
-                  <a class="guide-opensource-link" href="${TRANSCODES_GUARD_REPO_URL}" target="_blank" rel="noopener noreferrer" aria-label="transcodes-guard on GitHub">
-                    <svg class="guide-opensource-icon" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.435 9.795 8.205 11.385.6.105.825-.255.825-.57 0-.285-.015-1.23-.015-2.235-3.015.555-3.795-.735-4.035-1.41-.135-.345-.72-1.41-1.23-1.695-.42-.225-1.02-.78-.015-.795.945-.015 1.62.87 1.845 1.23 1.08 1.815 2.805 1.305 3.495.99.105-.78.42-1.305.765-1.605-2.67-.3-5.46-1.335-5.46-5.925 0-1.305.465-2.385 1.23-3.225-.12-.3-.54-1.53.12-3.18 0 0 1.005-.315 3.3 1.23.96-.27 1.98-.405 3-.405s2.04.135 3 .405c2.295-1.56 3.3-1.23 3.3-1.23.66 1.65.24 2.88.12 3.18.765.84 1.23 1.905 1.23 3.225 0 4.605-2.805 5.625-5.475 5.925.435.375.81 1.095.81 2.22 0 1.605-.015 2.895-.015 3.3 0 .315.225.69.825.57A12.02 12.02 0 0 0 24 12c0-6.63-5.37-12-12-12z"/></svg>
-                    We support Open Source, <span class="guide-opensource-accent">More Info</span>
-                  </a>
-                </p>
-              </div>
+            <li>
+              <details class="guide-step guide-step--accordion">
+                <summary class="guide-step-summary">
+                  <span class="guide-step-num">3</span>
+                  <span class="guide-step-title">Open your CLI or desktop app (Claude, Cursor, Antigravity, ChatGPT)</span>
+                  <svg class="guide-step-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>
+                </summary>
+                <div class="guide-step-body">
+                  <p class="guide-step-desc">If it's already running, restart it so the latest plugin and token are loaded</p>
+                </div>
+              </details>
             </li>
-            <li class="guide-step">
-              <span class="guide-step-num">9</span>
-              <div class="guide-step-body">
-                <p class="guide-step-title">Prompt-driven permissions</p>
-                <p class="guide-step-desc">Once installed, Transcodes AI interprets the prompts you send using the role, resource, and action settings you configured and enforces permissions accordingly</p>
-              </div>
+            <li>
+              <details class="guide-step guide-step--accordion">
+                <summary class="guide-step-summary">
+                  <span class="guide-step-num">4</span>
+                  <span class="guide-step-title">Run an action from the agent</span>
+                  <svg class="guide-step-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>
+                </summary>
+                <div class="guide-step-body">
+                  <p class="guide-step-desc">Try an action in your CLI or desktop app. Transcodes classifies each prompt into a <code>resource:action</code> pair, then applies the permission matrix \u2014 <strong>0 deny</strong> \xB7 <strong>1 allow (pass)</strong> \xB7 <strong>2 step-up MFA</strong>.</p>
+                  <ul class="guide-classify-list">
+                    <li><span class="guide-classify-prompt">"Create a Google Calendar event"</span> <span class="guide-classify-arrow">\u2192</span> <code class="cli-cmd">google:create</code></li>
+                    <li><span class="guide-classify-prompt">"Change James's role in Transcodes"</span> <span class="guide-classify-arrow">\u2192</span> <code class="cli-cmd">transcodes:update</code></li>
+                    <li><span class="guide-classify-prompt">"Delete files on my computer"</span> <span class="guide-classify-arrow">\u2192</span> <code class="cli-cmd">system:delete</code></li>
+                  </ul>
+                  <p class="guide-classify-note">No matching resource? It falls back to <code class="cli-cmd">system</code> automatically \u2014 e.g. if there's no <code>google</code> resource, "Create a Google Calendar event" becomes <code class="cli-cmd">system:create</code>.</p>
+                </div>
+              </details>
+            </li>
+            <li>
+              <details class="guide-step guide-step--accordion">
+                <summary class="guide-step-summary">
+                  <span class="guide-step-num">5</span>
+                  <span class="guide-step-title">Pull the audit log report</span>
+                  <svg class="guide-step-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>
+                </summary>
+                <div class="guide-step-body">
+                  <p class="guide-step-desc">Ask the agent for a member audit / security log report \u2014 Transcodes maps the prompt to the right resource and enforces RBAC</p>
+                  <p class="guide-step-desc">Every action is logged \u2014 whether it was 0 deny, 1 allow, or 2 step-up MFA.</p>
+                  <div class="guide-help-examples">
+                    <div class="guide-cmd-row">
+                      <span class="guide-cmd-hosts">Claude \xB7 Cursor \xB7 Antigravity</span>
+                      <code class="cli-cmd">/transcodes show audit logs report</code>
+                    </div>
+                    <div class="guide-cmd-row">
+                      <span class="guide-cmd-hosts">ChatGPT (Codex)</span>
+                      <code class="cli-cmd">$transcodes show audit logs report</code>
+                    </div>
+                  </div>
+                </div>
+              </details>
+            </li>
+            <li>
+              <details class="guide-step guide-step--accordion">
+                <summary class="guide-step-summary">
+                  <span class="guide-step-num">6</span>
+                  <span class="guide-step-title">Receive step-up links and notifications on Slack or Discord</span>
+                  <svg class="guide-step-chevron" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m6 9 6 6 6-6"/></svg>
+                </summary>
+                <div class="guide-step-body">
+                  <p class="guide-step-desc">Want step-up links delivered to Slack or Discord? Go to <a href="${APP_ORG_URL}" data-app-tab="settings" target="_blank" rel="noopener noreferrer">Transcodes Settings</a> and set up a webhook. (More channels coming soon.)</p>
+                </div>
+              </details>
             </li>
           </ol>
         </section>
@@ -1977,7 +2203,7 @@ function dashboardHtml() {
     </div>
 
     <div class="panel" id="panel-rbac">
-      <p id="rbac-token-warning" class="rbac-token-warning" hidden>Save a token on the Tokens tab first</p>
+      <p id="rbac-token-warning" class="rbac-token-warning" hidden>Save a Transcodes token(MAT) first</p>
       <div class="guide-help">
         <p class="guide-help-heading">How it works</p>
         <p class="guide-help-line">Transcodes AI interprets the prompt and maps it to a resource / action pair. Based on the member's role, it applies deny / allow / step-up from the permission matrix. Resources are matched by name and description \u2014 if nothing matches, it falls back to <code>system</code>. When integrating with your own back office, you can pass <code>resource</code> and <code>action</code> as params to control permissions directly.</p>
@@ -2002,7 +2228,7 @@ function dashboardHtml() {
         <button type="button" class="tab" data-rbac="roles" role="tab">Roles</button>
       </div>
       <div class="rbac-pane active" id="rbac-pane-resources">
-        <p class="section-sub">Configure resources, roles, and permissions directly in the Transcodes app. Click the logo or Transcodes at the top.</p>
+        <p class="section-sub">Configure resources, roles, and permissions. <a href="${APP_ORG_URL}" data-app-tab="rbac" target="_blank" rel="noopener noreferrer">Edit RBAC Permissions</a></p>
         <div class="rbac-table-wrap">
           <table class="rbac-table" id="resources-table">
             <thead><tr><th>Resource</th><th>Description</th></tr></thead>
@@ -2011,7 +2237,7 @@ function dashboardHtml() {
         </div>
       </div>
       <div class="rbac-pane" id="rbac-pane-roles">
-        <p class="section-sub">Select a role to view its permission matrix</p>
+        <p class="section-sub">Select a role to view its permission matrix \xB7 <a href="${APP_ORG_URL}" data-app-tab="rbac" target="_blank" rel="noopener noreferrer">Edit RBAC Permissions</a></p>
         <div class="role-picker" id="role-picker"></div>
         <div id="matrix-wrap" hidden>
           <p class="list-label" id="matrix-role-label"></p>
@@ -2035,7 +2261,14 @@ function dashboardHtml() {
     </div>
   </div>
 
-  <p class="dashboard-footer">Ver ${CLI_VERSION} <code class="cli-cmd">transcodes version</code></p>
+  <p class="dashboard-footer">
+    Ver ${CLI_VERSION} <code class="cli-cmd">transcodes version</code>
+    <span aria-hidden="true">\xB7</span>
+    <a href="${TRANSCODES_GUARD_REPO_URL}" target="_blank" rel="noopener noreferrer">
+      <svg class="dashboard-footer-github-icon" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.435 9.795 8.205 11.385.6.105.825-.255.825-.57 0-.285-.015-1.23-.015-2.235-3.015.555-3.795-.735-4.035-1.41-.135-.345-.72-1.41-1.23-1.695-.42-.225-1.02-.78-.015-.795.945-.015 1.62.87 1.845 1.23 1.08 1.815 2.805 1.305 3.495.99.105-.78.42-1.305.765-1.605-2.67-.3-5.46-1.335-5.46-5.925 0-1.305.465-2.385 1.23-3.225-.12-.3-.54-1.53.12-3.18 0 0 1.005-.315 3.3 1.23.96-.27 1.98-.405 3-.405s2.04.135 3 .405c2.295-1.56 3.3-1.23 3.3-1.23.66 1.65.24 2.88.12 3.18.765.84 1.23 1.905 1.23 3.225 0 4.605-2.805 5.625-5.475 5.925.435.375.81 1.095.81 2.22 0 1.605-.015 2.895-.015 3.3 0 .315.225.69.825.57A12.02 12.02 0 0 0 24 12c0-6.63-5.37-12-12-12z"/></svg>
+      GitHub
+    </a>
+  </p>
   <script>
     const tokenEl = document.getElementById("token");
     const labelEl = document.getElementById("label");
@@ -2047,7 +2280,7 @@ function dashboardHtml() {
     const headerProfileEl = document.getElementById("header-profile");
     const headerProfileNameEl = document.getElementById("header-profile-name");
     const headerProfileMetaEl = document.getElementById("header-profile-meta");
-    const manageAuthBtn = document.getElementById("manage-auth-btn");
+    const APP_ORG_URL = ${JSON.stringify(APP_ORG_URL)};
 
     let lastStatus = { tokens: [], activeMember: null };
     let editingId = null;
@@ -2056,14 +2289,58 @@ function dashboardHtml() {
       return Array.isArray(s.tokens) && s.tokens.length > 0;
     }
 
+    function updateAppDeepLinks(s) {
+      const pid = s && s.activeMember && s.activeMember.projectId;
+      document.querySelectorAll("[data-app-tab]").forEach((a) => {
+        const tab = a.getAttribute("data-app-tab");
+        if (pid && tab) {
+          a.href = APP_ORG_URL + "?pid=" + encodeURIComponent(pid) + "&tab=" + encodeURIComponent(tab);
+        } else {
+          a.href = APP_ORG_URL;
+        }
+      });
+    }
+
     function updateTokenEmptyState() {
       const empty = !hasSavedTokens(lastStatus);
       headerTokenEmptyEl.hidden = !empty;
       if (empty) {
         headerProfileEl.hidden = true;
+        updateAppDeepLinks(lastStatus);
         return;
       }
       renderHeaderProfile(lastStatus);
+      updateAppDeepLinks(lastStatus);
+    }
+
+    async function openConsole() {
+      const consoleBtns = document.querySelectorAll("[data-console-open]");
+      consoleBtns.forEach((btn) => { btn.disabled = true; });
+      try {
+        const res = await fetch("/api/console/open", { method: "POST" });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Could not open auth settings");
+        if (data.browserUrl) window.open(data.browserUrl, "_blank", "noopener,noreferrer");
+        showToast("Opening auth settings in your browser", "success");
+      } catch (e) {
+        showToast(e.message || "Failed to open auth settings", "error");
+      } finally {
+        consoleBtns.forEach((btn) => { btn.disabled = false; });
+      }
+    }
+
+    const guideVideoToggle = document.getElementById("guide-video-toggle");
+    const guideVideo = document.getElementById("guide-video");
+    if (guideVideoToggle && guideVideo) {
+      guideVideoToggle.addEventListener("click", () => {
+        const open = guideVideoToggle.getAttribute("aria-expanded") === "true";
+        const next = !open;
+        guideVideoToggle.setAttribute("aria-expanded", String(next));
+        guideVideo.hidden = !next;
+        guideVideoToggle.textContent = next
+          ? "Hide Intro Video"
+          : "Watch Intro Video";
+      });
     }
 
     document.querySelectorAll(".tab[data-tab]").forEach((tab) => {
@@ -2174,19 +2451,8 @@ function dashboardHtml() {
       renderTokens(lastStatus);
     }
 
-    manageAuthBtn.addEventListener("click", async () => {
-      manageAuthBtn.disabled = true;
-      try {
-        const res = await fetch("/api/console/open", { method: "POST" });
-        const data = await res.json();
-        if (!res.ok) throw new Error(data.error || "Could not open auth settings");
-        if (data.browserUrl) window.open(data.browserUrl, "_blank", "noopener,noreferrer");
-        showToast("Opening auth settings in your browser", "success");
-      } catch (e) {
-        showToast(e.message || "Failed to open auth settings", "error");
-      } finally {
-        manageAuthBtn.disabled = false;
-      }
+    document.querySelectorAll("[data-console-open]").forEach((btn) => {
+      btn.addEventListener("click", () => { openConsole(); });
     });
 
     async function saveLabel(id) {
@@ -2640,14 +2906,68 @@ function waitForDashboardShutdown(server) {
     process.on("SIGTERM", onSignal);
   });
 }
-async function runDashboard(options) {
-  const preferred = options.port ?? DEFAULT_PORT;
-  let server;
+async function pidsListeningOnPorts(from, to) {
+  const pids = /* @__PURE__ */ new Set();
+  if (process.platform === "win32") {
+    for (let port = from; port <= to; port++) {
+      try {
+        const { stdout } = await execFileAsync(
+          "powershell",
+          [
+            "-NoProfile",
+            "-Command",
+            `(Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue).OwningProcess`
+          ],
+          { timeout: 5e3 }
+        );
+        for (const line of stdout.split(/\r?\n/)) {
+          const pid = Number(line.trim());
+          if (Number.isInteger(pid) && pid > 0) pids.add(pid);
+        }
+      } catch {
+      }
+    }
+    return [...pids];
+  }
+  for (let port = from; port <= to; port++) {
+    try {
+      const { stdout } = await execFileAsync(
+        "lsof",
+        ["-ti", `tcp:${port}`, "-sTCP:LISTEN"],
+        { timeout: 5e3 }
+      );
+      for (const token of stdout.trim().split(/\s+/)) {
+        const pid = Number(token);
+        if (Number.isInteger(pid) && pid > 0) pids.add(pid);
+      }
+    } catch {
+    }
+  }
+  return [...pids];
+}
+async function freePortRange(from, to) {
+  process.stdout.write(`Freeing ports ${from}\u2013${to} \u2026
+`);
+  const pids = await pidsListeningOnPorts(from, to);
+  if (pids.length === 0) {
+    process.stdout.write("  (no listeners found)\n");
+    return;
+  }
+  for (const pid of pids) {
+    try {
+      process.kill(pid, "SIGKILL");
+      process.stdout.write(`  killed pid ${pid}
+`);
+    } catch {
+    }
+  }
+}
+async function tryBindPortRange(preferred) {
   let port = preferred;
-  for (let attempt = 0; attempt < 10; attempt++) {
+  for (let attempt = 0; attempt < PORT_ATTEMPTS; attempt++) {
     try {
-      server = await listen(port);
-      break;
+      const server = await listen(port);
+      return { server, port };
     } catch (err) {
       const code = err.code;
       if (code === "EADDRINUSE") {
@@ -2657,8 +2977,17 @@ async function runDashboard(options) {
       throw err;
     }
   }
-  if (!server) {
-    const last = preferred + 9;
+  return null;
+}
+async function runDashboard(options) {
+  const preferred = options.port ?? DEFAULT_PORT;
+  const last = preferred + PORT_ATTEMPTS - 1;
+  let bound = await tryBindPortRange(preferred);
+  if (!bound) {
+    await freePortRange(preferred, last);
+    bound = await tryBindPortRange(preferred);
+  }
+  if (!bound) {
     throw new Error(
       `could not find a free port in ${preferred}-${last} (all in use).
   A previous dashboard is probably still running.
@@ -2669,6 +2998,7 @@ async function runDashboard(options) {
   Or choose another port:  transcodes --port <N>`
     );
   }
+  const { server, port } = bound;
   const url = `http://${HOST}:${port}/`;
   process.stdout.write(
     `Transcodes dashboard running at ${url}
@@ -2682,6 +3012,882 @@ async function runDashboard(options) {
   await waitForDashboardShutdown(server);
 }
 
+// src/install.ts
+import { spawn as spawn3 } from "child_process";
+import fs from "fs";
+import os2 from "os";
+import path2 from "path";
+import { createInterface, moveCursor } from "readline";
+var REPO_SLUG = "transcodings/transcodes-guard";
+var REPO_GIT_URL = "https://github.com/transcodings/transcodes-guard.git";
+var MARKETPLACE = "bigstrider";
+var PLUGIN_NAME = "transcodes-guard";
+var APP_CONSOLE_URL = "https://app.transcodes.io";
+var MIN_NODE_MAJOR = 20;
+var PLATFORMS = [
+  { id: "claude", label: "Claude Code" },
+  { id: "codex", label: "ChatGPT (Codex)" },
+  {
+    id: "cursor",
+    label: "Cursor",
+    installerRel: "plugins/cursor/install.mjs"
+  },
+  {
+    id: "antigravity",
+    label: "Antigravity",
+    installerRel: "plugins/antigravity/install.mjs"
+  }
+];
+function log(line = "") {
+  process.stdout.write(`${line}
+`);
+}
+function clearScreen() {
+  process.stdout.write("\x1B[2J\x1B[H");
+}
+function isTty() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+function openUrl(url) {
+  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn3(opener, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function refreshPathHints() {
+  const home = os2.homedir();
+  const extras = [
+    path2.join(home, ".local", "bin"),
+    path2.join(home, ".claude", "bin"),
+    path2.join(home, ".codex", "bin"),
+    path2.join(home, ".cursor", "bin"),
+    path2.join(home, ".gemini", "bin"),
+    path2.join(home, "bin"),
+    "/usr/local/bin",
+    "/opt/homebrew/bin"
+  ];
+  const current = process.env.PATH ?? "";
+  const parts = current.split(path2.delimiter).filter(Boolean);
+  const merged = [...extras.filter((p) => !parts.includes(p)), ...parts];
+  process.env.PATH = merged.join(path2.delimiter);
+}
+function commandExists(cmd) {
+  return new Promise((resolve) => {
+    const child = process.platform === "win32" ? spawn3("where", [cmd], { stdio: "ignore" }) : spawn3("sh", ["-c", `command -v ${JSON.stringify(cmd)}`], {
+      stdio: "ignore"
+    });
+    child.on("error", () => resolve(false));
+    child.on("close", (code) => resolve(code === 0));
+  });
+}
+async function anyCommandExists(cmds) {
+  for (const cmd of cmds) {
+    if (await commandExists(cmd)) return cmd;
+  }
+  return null;
+}
+function run(cmd, args) {
+  return new Promise((resolve) => {
+    log(`
+$ ${cmd} ${args.join(" ")}`);
+    const child = spawn3(cmd, args, { stdio: "inherit", env: process.env });
+    child.on("error", (err) => {
+      log(`  (failed to start: ${err.message})`);
+      resolve(1);
+    });
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}
+function runShell(script) {
+  return new Promise((resolve) => {
+    log(`
+$ ${script}`);
+    const child = spawn3("sh", ["-c", script], {
+      stdio: "inherit",
+      env: process.env
+    });
+    child.on("error", (err) => {
+      log(`  (failed to start: ${err.message})`);
+      resolve(1);
+    });
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}
+async function runAll(steps) {
+  for (const step of steps) {
+    const code = await run(step.cmd, step.args);
+    if (code !== 0) return false;
+  }
+  return true;
+}
+function nodeMajor(version = process.versions.node) {
+  const major = Number(version.split(".")[0]);
+  return Number.isFinite(major) ? major : 0;
+}
+async function ensureNode() {
+  log("\u2500\u2500 Prerequisites \u2500\u2500");
+  const major = nodeMajor();
+  const onPath = await commandExists("node");
+  if (major >= MIN_NODE_MAJOR && onPath) {
+    log(`  \u2713 Node.js v${process.versions.node} (>= ${MIN_NODE_MAJOR})`);
+    return true;
+  }
+  if (major >= MIN_NODE_MAJOR && !onPath) {
+    log(
+      `  ! Node.js v${process.versions.node} is running this CLI but \`node\` is not on PATH.`
+    );
+    log("    Prepending common bin dirs and continuing\u2026");
+    refreshPathHints();
+    if (await commandExists("node")) {
+      log("  \u2713 Node.js now on PATH");
+      return true;
+    }
+  }
+  log(
+    major > 0 && major < MIN_NODE_MAJOR ? `  Node.js v${process.versions.node} is below ${MIN_NODE_MAJOR} \u2014 installing LTS\u2026` : "  Node.js not found \u2014 installing LTS\u2026"
+  );
+  let installed = false;
+  if (process.platform === "darwin" && await commandExists("brew")) {
+    installed = await run("brew", ["install", "node"]) === 0;
+  }
+  if (!installed && await commandExists("nvm")) {
+    installed = await runShell("nvm install --lts && nvm use --lts") === 0;
+  }
+  if (!installed) {
+    const nvmInstall = [
+      "curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash",
+      'export NVM_DIR="$HOME/.nvm"',
+      '[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"',
+      "nvm install --lts",
+      'nvm alias default "lts/*"'
+    ].join(" && ");
+    installed = await runShell(nvmInstall) === 0;
+  }
+  refreshPathHints();
+  const nvmDefaultBin = path2.join(os2.homedir(), ".nvm", "versions", "node");
+  if (fs.existsSync(nvmDefaultBin)) {
+    try {
+      const versions = fs.readdirSync(nvmDefaultBin).filter((v) => v.startsWith("v")).sort().reverse();
+      if (versions[0]) {
+        const bin = path2.join(nvmDefaultBin, versions[0], "bin");
+        process.env.PATH = `${bin}${path2.delimiter}${process.env.PATH ?? ""}`;
+      }
+    } catch {
+    }
+  }
+  if (await commandExists("node")) {
+    const ver = await new Promise((resolve) => {
+      const child = spawn3("node", ["-v"], {
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      let out = "";
+      child.stdout?.on("data", (c) => {
+        out += c.toString();
+      });
+      child.on("close", () => resolve(out.trim().replace(/^v/, "")));
+      child.on("error", () => resolve(""));
+    });
+    const installedMajor = nodeMajor(ver || "0");
+    if (installedMajor >= MIN_NODE_MAJOR) {
+      log(`  \u2713 Node.js v${ver} installed`);
+      return true;
+    }
+  }
+  log("");
+  log("Could not install Node.js LTS automatically.");
+  log(
+    `Install Node.js ${MIN_NODE_MAJOR}+ from https://nodejs.org then re-run:`
+  );
+  log("  transcodes install");
+  openUrl("https://nodejs.org");
+  return false;
+}
+var HOST_CLIS = {
+  claude: {
+    binaries: ["claude"],
+    label: "Claude Code CLI (`claude`)",
+    install: async () => {
+      if (process.platform === "win32") {
+        return await run("npm", ["install", "-g", "@anthropic-ai/claude-code"]) === 0;
+      }
+      const native = await runShell("curl -fsSL https://claude.ai/install.sh | bash") === 0;
+      if (native) return true;
+      return await run("npm", ["install", "-g", "@anthropic-ai/claude-code"]) === 0;
+    }
+  },
+  codex: {
+    binaries: ["codex"],
+    label: "Codex CLI (`codex`)",
+    install: async () => {
+      if (process.platform !== "win32") {
+        const native = await runShell(
+          "curl -fsSL https://chatgpt.com/codex/install.sh | sh"
+        ) === 0;
+        if (native) return true;
+      }
+      return await run("npm", ["install", "-g", "@openai/codex"]) === 0;
+    }
+  },
+  cursor: {
+    // Docs: `agent` is primary; `cursor-agent` is the backward-compatible name.
+    binaries: ["cursor-agent", "agent"],
+    label: "Cursor Agent CLI (`cursor-agent` / `agent`)",
+    install: async () => {
+      if (process.platform === "win32") {
+        return await runShell(
+          `powershell -NoProfile -Command "irm 'https://cursor.com/install?win32=true' | iex"`
+        ) === 0;
+      }
+      return await runShell("curl https://cursor.com/install -fsS | bash") === 0;
+    }
+  },
+  antigravity: {
+    binaries: ["agy"],
+    label: "Antigravity CLI (`agy`)",
+    install: async () => await runShell(
+      "curl -fsSL https://antigravity.google/cli/install.sh | bash"
+    ) === 0
+  }
+};
+async function ensureHostCli(id) {
+  const spec = HOST_CLIS[id];
+  refreshPathHints();
+  const found = await anyCommandExists(spec.binaries);
+  if (found) {
+    log(`  \u2713 ${spec.label} found (\`${found}\`)`);
+    return true;
+  }
+  log(`  ${spec.label} not found \u2014 installing\u2026`);
+  const ok = await spec.install();
+  refreshPathHints();
+  const after = await anyCommandExists(spec.binaries);
+  if (ok && after) {
+    log(`  \u2713 ${spec.label} installed (\`${after}\`)`);
+    return true;
+  }
+  log(`  \u2717 Failed to install ${spec.label}.`);
+  log("    Install it manually, then re-run `transcodes install`.");
+  return false;
+}
+function promptLine(question) {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
+function safeExists(p) {
+  try {
+    return fs.existsSync(p);
+  } catch {
+    return false;
+  }
+}
+function dirHasMatch(dir, needles) {
+  try {
+    return fs.readdirSync(dir).some((entry) => needles.some((n) => entry.includes(n)));
+  } catch {
+    return false;
+  }
+}
+function fileHas(file, needle) {
+  try {
+    return fs.readFileSync(file, "utf8").includes(needle);
+  } catch {
+    return false;
+  }
+}
+function isPluginInstalled(id) {
+  const home = os2.homedir();
+  switch (id) {
+    case "cursor":
+      return safeExists(
+        path2.join(home, ".cursor", "plugins", "local", "transcodes-guard")
+      );
+    case "antigravity":
+      return safeExists(
+        path2.join(home, ".gemini", "config", "plugins", "transcodes-guard")
+      );
+    case "claude":
+      return dirHasMatch(path2.join(home, ".claude", "plugins"), [
+        "transcodes-guard",
+        "bigstrider"
+      ]) || dirHasMatch(path2.join(home, ".claude", "plugins", "marketplaces"), [
+        "bigstrider",
+        "transcodes-guard"
+      ]) || fileHas(
+        path2.join(home, ".claude", "settings.json"),
+        "transcodes-guard"
+      ) || fileHas(path2.join(home, ".claude.json"), "transcodes-guard");
+    case "codex":
+      return dirHasMatch(path2.join(home, ".codex", "plugins"), [
+        "transcodes-guard",
+        "bigstrider"
+      ]) || fileHas(path2.join(home, ".codex", "config.toml"), "transcodes-guard") || fileHas(path2.join(home, ".codex", "config.json"), "transcodes-guard");
+  }
+}
+function renderMenu() {
+  log("");
+  log("Please select platforms that you want to install:");
+  log("Installing a plugin enables both its CLI and desktop app.");
+  log("(Claude only supports the Claude Code tab)");
+  log("");
+  PLATFORMS.forEach((p, i) => {
+    const mark = isPluginInstalled(p.id) ? "   [Installed \u2713]" : "";
+    log(`  ${i + 1}. ${p.label}${mark}`);
+  });
+  log(`  ${PLATFORMS.length + 1}. Next Step \u2192`);
+  log("");
+  log('Enter numbers to install (e.g. 1,2), "all" or Enter to install all.');
+  log(
+    `Type ${PLATFORMS.length + 1} (or "next") for Next Step, "exit"/"q" to quit.`
+  );
+}
+async function promptMenu() {
+  const nextNum = String(PLATFORMS.length + 1);
+  for (; ; ) {
+    const answer = (await promptLine("> ")).trim().toLowerCase();
+    if (answer === "exit" || answer === "q") return { kind: "cancel" };
+    if (answer === "next" || answer === "n" || answer === nextNum) {
+      return { kind: "next" };
+    }
+    if (answer === "" || answer === "all" || answer === "a") {
+      return { kind: "install", ids: PLATFORMS.map((p) => p.id) };
+    }
+    const tokens = answer.split(/[\s,]+/).filter(Boolean);
+    const ids = [];
+    let invalid = false;
+    for (const token of tokens) {
+      const num = Number(token);
+      if (!Number.isInteger(num) || num < 1 || num > PLATFORMS.length) {
+        log(
+          `  Invalid choice "${token}". Use 1\u2013${PLATFORMS.length}, ${nextNum} (Next Step), all, or exit.`
+        );
+        invalid = true;
+        break;
+      }
+      const pid = PLATFORMS[num - 1].id;
+      if (!ids.includes(pid)) ids.push(pid);
+    }
+    if (invalid) continue;
+    return { kind: "install", ids };
+  }
+}
+function supportsArrowSelect() {
+  return isTty() && typeof process.stdin.setRawMode === "function";
+}
+function arrowSelect(checked) {
+  return new Promise((resolve) => {
+    const rowCount = PLATFORMS.length + 1;
+    let cursor = 0;
+    let rendered = 0;
+    const { stdin, stdout } = process;
+    const draw = () => {
+      const lines = [];
+      lines.push("Please select platforms that you want to install:");
+      lines.push("Installing a plugin enables both its CLI and desktop app.");
+      lines.push("(Claude only supports the Claude Code tab)");
+      lines.push("");
+      PLATFORMS.forEach((p, i) => {
+        const pointer = cursor === i ? "\u276F" : " ";
+        const box = checked.has(p.id) ? "\u25C9" : "\u25EF";
+        const mark = isPluginInstalled(p.id) ? "   [Installed \u2713]" : "";
+        lines.push(`${pointer} ${box} ${p.label}${mark}`);
+      });
+      const nextPointer = cursor === PLATFORMS.length ? "\u276F" : " ";
+      lines.push(`${nextPointer}   Next Step \u2192`);
+      lines.push("");
+      lines.push(
+        "\u2191/\u2193 move \xB7 space select \xB7 a all/none \xB7 enter confirm \xB7 q quit/exit"
+      );
+      if (rendered > 0) moveCursor(stdout, 0, -rendered);
+      const frame = lines.map((line) => `${line}\x1B[K`).join("\n");
+      stdout.write(`${frame}
+`);
+      rendered = lines.length;
+    };
+    const cleanup = () => {
+      stdout.write("\x1B[?25h");
+      stdin.setRawMode?.(false);
+      stdin.pause();
+      stdin.removeListener("data", onData);
+    };
+    const onData = (buf) => {
+      const key = buf.toString();
+      if (key === "" || key === "q") {
+        cleanup();
+        resolve({ kind: "cancel" });
+        return;
+      }
+      if (key === "\r" || key === "\n") {
+        cleanup();
+        if (cursor === PLATFORMS.length) {
+          resolve({ kind: "next" });
+        } else {
+          resolve({
+            kind: "install",
+            ids: PLATFORMS.filter((p) => checked.has(p.id)).map((p) => p.id)
+          });
+        }
+        return;
+      }
+      if (key === " ") {
+        if (cursor < PLATFORMS.length) {
+          const id = PLATFORMS[cursor].id;
+          if (checked.has(id)) checked.delete(id);
+          else checked.add(id);
+        }
+      } else if (key === "a") {
+        if (PLATFORMS.every((p) => checked.has(p.id))) checked.clear();
+        else for (const p of PLATFORMS) checked.add(p.id);
+      } else if (key === "\x1B[A" || key === "k") {
+        cursor = (cursor - 1 + rowCount) % rowCount;
+      } else if (key === "\x1B[B" || key === "j") {
+        cursor = (cursor + 1) % rowCount;
+      } else {
+        return;
+      }
+      draw();
+    };
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stdin.on("data", onData);
+    stdout.write("\x1B[?25l");
+    draw();
+  });
+}
+function arrowChoose(title, options, defaultIndex = 0) {
+  return new Promise((resolve) => {
+    let cursor = Math.max(0, Math.min(defaultIndex, options.length - 1));
+    let rendered = 0;
+    const { stdin, stdout } = process;
+    const draw = () => {
+      const lines = [title];
+      options.forEach((opt, i) => {
+        const pointer = cursor === i ? "\u276F" : " ";
+        const radio = cursor === i ? "\u25C9" : "\u25EF";
+        lines.push(`${pointer} ${radio} ${opt}`);
+      });
+      lines.push("");
+      lines.push("\u2191/\u2193 move \xB7 enter select");
+      if (rendered > 0) moveCursor(stdout, 0, -rendered);
+      stdout.write(`${lines.map((line) => `${line}\x1B[K`).join("\n")}
+`);
+      rendered = lines.length;
+    };
+    const cleanup = () => {
+      stdout.write("\x1B[?25h");
+      stdin.setRawMode?.(false);
+      stdin.pause();
+      stdin.removeListener("data", onData);
+    };
+    const onData = (buf) => {
+      const key = buf.toString();
+      if (key === "") {
+        cleanup();
+        resolve(-1);
+        return;
+      }
+      if (key === "\r" || key === "\n") {
+        cleanup();
+        resolve(cursor);
+        return;
+      }
+      if (key === "\x1B[A" || key === "k") {
+        cursor = (cursor - 1 + options.length) % options.length;
+      } else if (key === "\x1B[B" || key === "j") {
+        cursor = (cursor + 1) % options.length;
+      } else {
+        return;
+      }
+      draw();
+    };
+    stdin.setRawMode?.(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stdin.on("data", onData);
+    stdout.write("\x1B[?25l");
+    draw();
+  });
+}
+async function chooseTokenAction(question) {
+  const options = ["Yes", "No", "Skip \u2014 token already configured"];
+  if (supportsArrowSelect()) {
+    const idx = await arrowChoose(question, options, 0);
+    return idx === 2 ? "skip" : idx === 0 ? "yes" : "no";
+  }
+  for (; ; ) {
+    log(question);
+    for (let i = 0; i < options.length; i++) {
+      log(`  ${i + 1}. ${options[i]}`);
+    }
+    const answer = (await promptLine("> ")).trim().toLowerCase();
+    if (answer === "1" || answer === "y" || answer === "yes") return "yes";
+    if (answer === "2" || answer === "n" || answer === "no") return "no";
+    if (answer === "3" || answer === "skip" || answer === "s") return "skip";
+    log("  Please choose 1, 2, or 3.");
+  }
+}
+async function runInstalls(ids) {
+  const clonedRepoDir = await cloneRepoIfNeeded(ids);
+  const results = /* @__PURE__ */ new Map();
+  try {
+    for (const id of ids) {
+      const label = PLATFORMS.find((p) => p.id === id)?.label ?? id;
+      log(`
+\u2500\u2500 ${label} \u2500\u2500`);
+      results.set(id, await installPlatform(id, clonedRepoDir));
+    }
+  } finally {
+    if (clonedRepoDir) {
+      fs.rmSync(clonedRepoDir, { recursive: true, force: true });
+    }
+  }
+  log("\n\u2500\u2500 Install summary \u2500\u2500");
+  for (const id of ids) {
+    const label = PLATFORMS.find((p) => p.id === id)?.label ?? id;
+    log(`  ${results.get(id) ? "\u2713" : "\u2717"} ${label}`);
+  }
+}
+async function installPlatform(id, clonedRepoDir) {
+  if (!await ensureHostCli(id)) return false;
+  if (id === "claude") {
+    return runAll([
+      { cmd: "claude", args: ["plugin", "marketplace", "add", REPO_SLUG] },
+      {
+        cmd: "claude",
+        args: [
+          "plugin",
+          "install",
+          `${PLUGIN_NAME}@${MARKETPLACE}`,
+          "--scope",
+          "user"
+        ]
+      }
+    ]);
+  }
+  if (id === "codex") {
+    return runAll([
+      { cmd: "codex", args: ["plugin", "marketplace", "add", REPO_SLUG] },
+      {
+        cmd: "codex",
+        args: ["plugin", "add", `${PLUGIN_NAME}@${MARKETPLACE}`]
+      }
+    ]);
+  }
+  const platform = PLATFORMS.find((p) => p.id === id);
+  if (!clonedRepoDir || !platform?.installerRel) {
+    log(`  Skipped ${platform?.label ?? id} \u2014 repo clone unavailable.`);
+    return false;
+  }
+  const installer = path2.join(clonedRepoDir, platform.installerRel);
+  if (!fs.existsSync(installer)) {
+    log(`  Skipped ${platform.label} \u2014 installer missing at ${installer}.`);
+    return false;
+  }
+  return await run("node", [installer]) === 0;
+}
+async function cloneRepoIfNeeded(platforms) {
+  const needsClone = platforms.some(
+    (id) => PLATFORMS.find((p) => p.id === id)?.installerRel
+  );
+  if (!needsClone) return null;
+  if (!await commandExists("git")) {
+    log("\n`git` not found on PATH \u2014 cannot install Cursor / Antigravity.");
+    log("Install git and re-run, or use the one-liners from the README.");
+    return null;
+  }
+  const tmpDir = fs.mkdtempSync(path2.join(os2.tmpdir(), "tg-install-"));
+  const ok = await run("git", ["clone", "--depth", "1", REPO_GIT_URL, tmpDir]) === 0;
+  if (!ok) {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    log("\nRepo clone failed \u2014 skipping Cursor / Antigravity.");
+    return null;
+  }
+  return tmpDir;
+}
+async function registerToken() {
+  log("");
+  log("\u2500\u2500 Register MAT token \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const token = (await promptLine("Paste your token: ")).trim();
+    if (!token) {
+      log("  Token is required.");
+      continue;
+    }
+    try {
+      parseMemberAccessToken(token);
+    } catch (err) {
+      log(
+        `  Token rejected: ${err instanceof Error ? err.message : String(err)}`
+      );
+      continue;
+    }
+    let label = "";
+    while (!label) {
+      label = (await promptLine("Label (e.g. transcodes-myproject-prod): ")).trim();
+      if (!label) log("  Label is required.");
+    }
+    writeTokenToFile(token, label);
+    log(`
+Saved token to ${transcodesConfigFile()} (label=${label}).`);
+    log("");
+    log(
+      "Please restart your CLI or desktop app to activate transcodes plugins."
+    );
+    return true;
+  }
+  log("\nToo many invalid attempts \u2014 run `transcodes install` again later.");
+  return false;
+}
+function printSetupComplete() {
+  clearScreen();
+  log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  log("  Congratulations!");
+  log("  All setup is completed.");
+  log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  log("");
+  log("Plugins are installed and your MAT token is saved.");
+  log("");
+}
+async function tokenFlow() {
+  log("");
+  log("\u2500\u2500 Token setup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  const choice = await chooseTokenAction(
+    "Do you have a Transcodes project MAT (Member Access Token)?"
+  );
+  if (choice === "skip") {
+    log("");
+    log("Skipping token setup \u2014 using the token already configured.");
+    return true;
+  }
+  if (choice === "no") {
+    log("");
+    log(
+      "You can create a MAT (Member Access Token) in the Transcodes console."
+    );
+    log(
+      "If you don't have access, ask your project administrator to issue one for you."
+    );
+    log("");
+    await promptLine(`Press ENTER to open the console (${APP_CONSOLE_URL}) \u2026 `);
+    log(`
+Opening ${APP_CONSOLE_URL} \u2026`);
+    openUrl(APP_CONSOLE_URL);
+    log("");
+    log("  1) After sign-in, create a new project on the dashboard.");
+    log('  2) Open the "Members & Tokens" tab and add a new member.');
+    log(
+      "  3) Generate a new token for that member, or ask your manager to get a token."
+    );
+    log("  4) Paste it here.");
+  }
+  return registerToken();
+}
+function parseSelection(args) {
+  const ids = [];
+  let explicit = false;
+  for (const arg of args) {
+    if (arg === "--all") {
+      return PLATFORMS.map((p) => p.id);
+    }
+    const match = PLATFORMS.find(
+      (p) => p.id === arg || arg === "chatgpt" && p.id === "codex"
+    );
+    if (match) {
+      explicit = true;
+      if (!ids.includes(match.id)) ids.push(match.id);
+    }
+  }
+  return explicit ? ids : "interactive";
+}
+async function cmdInstall(args) {
+  log("transcodes install \u2014 set up plugins, token, and dashboard.\n");
+  if (!await ensureNode()) {
+    process.exit(1);
+  }
+  log("");
+  const selection = parseSelection(args);
+  let openDashboard = false;
+  if (selection === "interactive") {
+    if (!isTty()) {
+      log(
+        "Non-interactive shell detected. Specify platforms explicitly, e.g.:"
+      );
+      log("  transcodes install --all");
+      log("  transcodes install claude codex cursor antigravity");
+      process.exit(1);
+    }
+    const useArrows = supportsArrowSelect();
+    const checked = /* @__PURE__ */ new Set();
+    let firstMenu = true;
+    for (; ; ) {
+      if (!firstMenu) clearScreen();
+      firstMenu = false;
+      let choice;
+      if (useArrows) {
+        choice = await arrowSelect(checked);
+      } else {
+        renderMenu();
+        choice = await promptMenu();
+      }
+      if (choice.kind === "cancel") {
+        log("");
+        log(
+          "If you want to manage tokens directly, please type `transcodes` to open the dashboard"
+        );
+        process.exit(0);
+      }
+      if (choice.kind === "next") {
+        clearScreen();
+        break;
+      }
+      if (choice.ids.length === 0) {
+        log("  Nothing selected.");
+        continue;
+      }
+      checked.clear();
+      for (const id of choice.ids) checked.add(id);
+      await runInstalls(choice.ids);
+    }
+  } else {
+    if (selection.length === 0) {
+      log("No platforms selected \u2014 nothing to install.");
+      process.exit(0);
+    }
+    log(
+      `
+Installing: ${selection.map((id) => PLATFORMS.find((p) => p.id === id)?.label ?? id).join(", ")}`
+    );
+    await runInstalls(selection);
+    clearScreen();
+  }
+  openDashboard = await tokenFlow();
+  if (!openDashboard) {
+    process.exit(0);
+  }
+  printSetupComplete();
+  await promptLine("Press ENTER to open the transcodes CLI dashboard \u2026 ");
+  await runDashboard({});
+  process.exit(0);
+}
+function installedPlatforms() {
+  return PLATFORMS.filter((p) => isPluginInstalled(p.id)).map((p) => p.id);
+}
+async function updateCliPackage() {
+  log(`
+\u2500\u2500 ${CLI_PACKAGE_NAME} (CLI) \u2500\u2500`);
+  log(`  Current version: ${CLI_VERSION}`);
+  if (!await commandExists("npm")) {
+    log("  \u2717 `npm` not found on PATH \u2014 cannot update the CLI.");
+    log(
+      `    Install Node.js / npm, then: npm install -g ${CLI_PACKAGE_NAME}@latest`
+    );
+    return false;
+  }
+  const ok = await run("npm", ["install", "-g", `${CLI_PACKAGE_NAME}@latest`]) === 0;
+  if (ok) {
+    log("  \u2713 CLI updated (run `transcodes version` to confirm).");
+  } else {
+    log("  \u2717 CLI update failed.");
+  }
+  return ok;
+}
+async function cmdUpdate(args) {
+  log("transcodes update \u2014 refresh plugins and CLI.\n");
+  if (!await ensureNode()) {
+    process.exit(1);
+  }
+  let cliOnly = false;
+  let pluginsOnly = false;
+  let forceAll = false;
+  const platformArgs = [];
+  for (const arg of args) {
+    if (arg === "--cli-only") cliOnly = true;
+    else if (arg === "--plugins-only") pluginsOnly = true;
+    else if (arg === "--all") forceAll = true;
+    else if (arg.startsWith("-")) {
+      log(`Unknown flag "${arg}".`);
+      log(
+        "Usage: transcodes update [--cli-only|--plugins-only|--all] [claude|codex|cursor|antigravity \u2026]"
+      );
+      process.exit(1);
+    } else {
+      platformArgs.push(arg);
+    }
+  }
+  if (cliOnly && pluginsOnly) {
+    log("Cannot combine --cli-only and --plugins-only.");
+    process.exit(1);
+  }
+  const results = [];
+  if (!cliOnly) {
+    let targets;
+    if (forceAll) {
+      targets = PLATFORMS.map((p) => p.id);
+    } else if (platformArgs.length > 0) {
+      const parsed = parseSelection(platformArgs);
+      if (parsed === "interactive" || parsed.length === 0) {
+        log(
+          "No valid platforms. Use: claude, codex, cursor, antigravity (or chatgpt)."
+        );
+        process.exit(1);
+      }
+      targets = parsed;
+    } else {
+      targets = installedPlatforms();
+    }
+    if (targets.length === 0) {
+      log("No installed plugins detected.");
+      log("  Run `transcodes install` first, or `transcodes update --all`.");
+    } else {
+      log(
+        `Updating plugins: ${targets.map((id) => PLATFORMS.find((p) => p.id === id)?.label ?? id).join(", ")}`
+      );
+      const clonedRepoDir = await cloneRepoIfNeeded(targets);
+      try {
+        for (const id of targets) {
+          const label = PLATFORMS.find((p) => p.id === id)?.label ?? id;
+          log(`
+\u2500\u2500 ${label} \u2500\u2500`);
+          const ok = await installPlatform(id, clonedRepoDir);
+          results.push({ name: label, ok });
+        }
+      } finally {
+        if (clonedRepoDir) {
+          fs.rmSync(clonedRepoDir, { recursive: true, force: true });
+        }
+      }
+    }
+  }
+  if (!pluginsOnly) {
+    const ok = await updateCliPackage();
+    results.push({ name: `${CLI_PACKAGE_NAME} (CLI)`, ok });
+  }
+  log("\n\u2500\u2500 Update summary \u2500\u2500");
+  if (results.length === 0) {
+    log("  (nothing to update)");
+  } else {
+    for (const r of results) {
+      log(`  ${r.ok ? "\u2713" : "\u2717"} ${r.name}`);
+    }
+  }
+  log("");
+  log("Done. Restart your host apps/CLIs so they pick up the new plugin.");
+  process.exit(results.some((r) => !r.ok) ? 1 : 0);
+}
+
 // src/index.ts
 function fail(message) {
   process.stderr.write(`transcodes: ${message}
@@ -2838,6 +4044,12 @@ async function cmdDashboard(args) {
 function main() {
   const [command, ...rest] = process.argv.slice(2);
   switch (command) {
+    case "install":
+      void cmdInstall(rest);
+      break;
+    case "update":
+      void cmdUpdate(rest);
+      break;
     case "set":
       cmdSet(rest);
       break;